OpenAI Pipeline Generates 948 Linux Root Exploits in 30 Hours for $1.2 Million
Updated
Updated · The Hacker News · Nov 5
OpenAI Pipeline Generates 948 Linux Root Exploits in 30 Hours for $1.2 Million
3 articles · Updated · The Hacker News · Nov 5
Summary
OpenAI said a mid-October run of its upcoming cyber model reproduced 1,724 Linux vulnerabilities in 30 hours and turned 948 into working local privilege escalation exploits on a commonly used distribution.
The agentic pipeline screened 2,308 kernel findings, generated 291 information-leak PoCs, then produced patches for validated flaws before human reviewers checked severity, exploits and fixes.
API costs totaled $1,213,430—about $1,279 per LPE exploit—and OpenAI said the system discovered at least 10 novel Linux exploitation techniques, including new page-grooming and data-only privilege-escalation methods.
The result expands on 24 LPE exploits OpenAI disclosed in June from its GPT-5.5-Cyber model and underscores its claim that automated patching must keep pace with AI-driven vulnerability discovery.
That warning aligns with broader industry alarms: GTIG said monthly disclosed vulnerabilities rose from 5,045 in January to 10,740 in August, while the U.K. NCSC said AI is shrinking patch windows even as it helps attackers weaponize flaws faster.
AI found nearly a thousand Linux flaws in days, but who will review the massive wave of automated patches?
Will the million-dollar cost of automated bug discovery price out independent researchers while supercharging state-sponsored cyber warfare?
If an AI invents ten novel hacking techniques overnight, how can traditional security teams possibly defend their networks?
948 Linux Kernel Zero-Days in 10 Days: How AI-Powered Pipelines Are Reshaping Vulnerability Discovery, Exploit Economics, and Enterprise Security
Overview
In October 2026, OpenAI’s cybersecurity division launched an advanced AI-driven pipeline to audit the Linux kernel, building on earlier initiatives that steadily increased exploit discovery and efficiency. The pipeline used a multi-stage workflow—starting with Scout agents identifying high-risk code, followed by Analyst and Triage agents validating vulnerabilities, and Exploit-development agents generating 948 unique privilege escalation exploits at a fraction of traditional costs. Human experts reviewed all findings to ensure accuracy and proper attribution, addressing early issues where AI sometimes misattributed exploits. This breakthrough not only revealed novel exploitation techniques but also highlighted a shift in cybersecurity: the main challenge now lies in rapid remediation and patching, as automated discovery far outpaces manual review and patch deployment.